The Tier-3 OAuth check proves a DPoP nonce works, but does not assert the time-based invariants from the spec: nonce rotation with a maximum lifetime of 5 minutes, acceptance of recently-stale nonces, and rejection of a stale nonce with use_dpop_nonce + a fresh dpop-nonce header.
This is a distinct, time-based check: either a fake clock or a real wait (a >5min check needs a generous timeoutMs and probably a slow tag).
Done when: a check asserts the rotation window and the stale-nonce rejection path against the oracle.